High-impact actions with no human in the loop

Design it out

Keep irreversible actions behind a person, and make the rest undoable. Agents work in their own environment, never with production rights by default.

• Ephemeral execution sandbox The agent runs commands in a disposable container with no host access and no network by default.
• Human checkpoint for high-impact actions Payments and other irreversible actions wait for a person to approve them.
• System-rendered confirmation Before a risky action, the app (not the model) shows the user the exact action and parameters to approve.
• Approval for risky commands Commands outside a safe list need the developer's approval, shown by the system, before they run.
• Make it undoable Backups, soft delete and versioning, so a bad action can be rolled back.
• Step, budget and loop limits Circuit breakers stop chains that run too long, cost too much or repeat themselves.
• No standing secrets for the agent The agent gets short-lived, task-scoped credentials instead of the developer's own keys and tokens.

The agent design check flags it as: It can do lasting damage; Test and production aren't separated.